
<!doctype html>
<html lang="en" class="no-js">
  <head>
    
      <meta charset="utf-8">
      <meta name="viewport" content="width=device-width,initial-scale=1">
      
      
      
      <link rel="icon" href="../../../../static/images/favicon.png">
      <meta name="generator" content="mkdocs-1.3.0, mkdocs-material-8.2.8">
    
    
      
        <title>Linux 生产内核网络参数调优分析 - WL4G DOCS</title>
      
    
    
      <link rel="stylesheet" href="../../../../assets/stylesheets/main.644de097.min.css">
      
        
        <link rel="stylesheet" href="../../../../assets/stylesheets/palette.e6a45f82.min.css">
        
      
    
    
    
      
        
        
        <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
        <link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Roboto:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback">
        <style>:root{--md-text-font:"Roboto";--md-code-font:"Roboto Mono"}</style>
      
    
    
      <link rel="stylesheet" href="../../../../static/css/util.css">
    
    <script>__md_scope=new URL("../../../..",location),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script>
    
      

    
    
  </head>
  
  
    
    
      
    
    
    
    
    <body dir="ltr" data-md-color-scheme="default" data-md-color-primary="" data-md-color-accent="">
  
    
    
      <script>var palette=__md_get("__palette");if(palette&&"object"==typeof palette.color)for(var key of Object.keys(palette.color))document.body.setAttribute("data-md-color-"+key,palette.color[key])</script>
    
    <input class="md-toggle" data-md-toggle="drawer" type="checkbox" id="__drawer" autocomplete="off">
    <input class="md-toggle" data-md-toggle="search" type="checkbox" id="__search" autocomplete="off">
    <label class="md-overlay" for="__drawer"></label>
    <div data-md-component="skip">
      
        
        <a href="#linux" class="md-skip">
          Skip to content
        </a>
      
    </div>
    <div data-md-component="announce">
      
    </div>
    
      <div data-md-component="outdated" hidden>
        <aside class="md-banner md-banner--warning">
          
        </aside>
      </div>
    
    
      

<header class="md-header" data-md-component="header">
  <nav class="md-header__inner md-grid" aria-label="Header">
    <a href="../../../.." title="WL4G DOCS" class="md-header__button md-logo" aria-label="WL4G DOCS" data-md-component="logo">
      
  <img src="../../../../static/images/mylogo.jpeg" alt="logo">

    </a>
    <label class="md-header__button md-icon" for="__drawer">
      <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M3 6h18v2H3V6m0 5h18v2H3v-2m0 5h18v2H3v-2z"/></svg>
    </label>
    <div class="md-header__title" data-md-component="header-title">
      <div class="md-header__ellipsis">
        <div class="md-header__topic">
          <span class="md-ellipsis">
            WL4G DOCS
          </span>
        </div>
        <div class="md-header__topic" data-md-component="header-topic">
          <span class="md-ellipsis">
            
              Linux 生产内核网络参数调优分析
            
          </span>
        </div>
      </div>
    </div>
    
      <form class="md-header__option" data-md-component="palette">
        
          
          
          <input class="md-option" data-md-color-media="(prefers-color-scheme: light)" data-md-color-scheme="default" data-md-color-primary="" data-md-color-accent=""  aria-label="Switch to dark mode"  type="radio" name="__palette" id="__palette_1">
          
            <label class="md-header__button md-icon" title="Switch to dark mode" for="__palette_2" hidden>
              <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M17 6H7c-3.31 0-6 2.69-6 6s2.69 6 6 6h10c3.31 0 6-2.69 6-6s-2.69-6-6-6zm0 10H7c-2.21 0-4-1.79-4-4s1.79-4 4-4h10c2.21 0 4 1.79 4 4s-1.79 4-4 4zM7 9c-1.66 0-3 1.34-3 3s1.34 3 3 3 3-1.34 3-3-1.34-3-3-3z"/></svg>
            </label>
          
        
          
          
          <input class="md-option" data-md-color-media="(prefers-color-scheme: dark)" data-md-color-scheme="slate" data-md-color-primary="" data-md-color-accent=""  aria-label="Switch to light mode"  type="radio" name="__palette" id="__palette_2">
          
            <label class="md-header__button md-icon" title="Switch to light mode" for="__palette_1" hidden>
              <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M17 7H7a5 5 0 0 0-5 5 5 5 0 0 0 5 5h10a5 5 0 0 0 5-5 5 5 0 0 0-5-5m0 8a3 3 0 0 1-3-3 3 3 0 0 1 3-3 3 3 0 0 1 3 3 3 3 0 0 1-3 3z"/></svg>
            </label>
          
        
      </form>
    
    
      <div class="md-header__option">
        <div class="md-select">
          
          <button class="md-header__button md-icon" aria-label="Select language">
            <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="m12.87 15.07-2.54-2.51.03-.03A17.52 17.52 0 0 0 14.07 6H17V4h-7V2H8v2H1v2h11.17C11.5 7.92 10.44 9.75 9 11.35 8.07 10.32 7.3 9.19 6.69 8h-2c.73 1.63 1.73 3.17 2.98 4.56l-5.09 5.02L4 19l5-5 3.11 3.11.76-2.04M18.5 10h-2L12 22h2l1.12-3h4.75L21 22h2l-4.5-12m-2.62 7 1.62-4.33L19.12 17h-3.24z"/></svg>
          </button>
          <div class="md-select__inner">
            <ul class="md-select__list">
              
                <li class="md-select__item">
                  <a href="/en/" hreflang="en" class="md-select__link">
                    English
                  </a>
                </li>
                
                <li class="md-select__item">
                  <a href="/zh/" hreflang="zh" class="md-select__link">
                    简体中文
                  </a>
                </li>
                
            </ul>
          </div>
        </div>
      </div>
    
    
      <label class="md-header__button md-icon" for="__search">
        <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.516 6.516 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5z"/></svg>
      </label>
      <div class="md-search" data-md-component="search" role="dialog">
  <label class="md-search__overlay" for="__search"></label>
  <div class="md-search__inner" role="search">
    <form class="md-search__form" name="search">
      <input type="text" class="md-search__input" name="query" aria-label="Search" placeholder="Search" autocapitalize="off" autocorrect="off" autocomplete="off" spellcheck="false" data-md-component="search-query" required>
      <label class="md-search__icon md-icon" for="__search">
        <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.516 6.516 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5z"/></svg>
        <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11h12z"/></svg>
      </label>
      <nav class="md-search__options" aria-label="Search">
        
        <button type="reset" class="md-search__icon md-icon" aria-label="Clear" tabindex="-1">
          <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12 19 6.41z"/></svg>
        </button>
      </nav>
      
        <div class="md-search__suggest" data-md-component="search-suggest"></div>
      
    </form>
    <div class="md-search__output">
      <div class="md-search__scrollwrap" data-md-scrollfix>
        <div class="md-search-result" data-md-component="search-result">
          <div class="md-search-result__meta">
            Initializing search
          </div>
          <ol class="md-search-result__list"></ol>
        </div>
      </div>
    </div>
  </div>
</div>
    
    
  </nav>
  
</header>
    
    <div class="md-container" data-md-component="container">
      
      
        
          
            
<nav class="md-tabs" aria-label="Tabs" data-md-component="tabs">
  <div class="md-tabs__inner md-grid">
    <ul class="md-tabs__list">
      
        
  
  


  
  
  
    <li class="md-tabs__item">
      <a href="../../../.." class="md-tabs__link">
        Getting Started
      </a>
    </li>
  

      
    </ul>
  </div>
</nav>
          
        
      
      <main class="md-main" data-md-component="main">
        <div class="md-main__inner md-grid">
          
            
              
              <div class="md-sidebar md-sidebar--primary" data-md-component="sidebar" data-md-type="navigation" >
                <div class="md-sidebar__scrollwrap">
                  <div class="md-sidebar__inner">
                    

  


  

<nav class="md-nav md-nav--primary md-nav--lifted md-nav--integrated" aria-label="Navigation" data-md-level="0">
  <label class="md-nav__title" for="__drawer">
    <a href="../../../.." title="WL4G DOCS" class="md-nav__button md-logo" aria-label="WL4G DOCS" data-md-component="logo">
      
  <img src="../../../../static/images/mylogo.jpeg" alt="logo">

    </a>
    WL4G DOCS
  </label>
  
  <ul class="md-nav__list" data-md-scrollfix>
    
      
      
      

  
  
  
    
    <li class="md-nav__item md-nav__item--nested">
      
      
        <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_1" data-md-state="indeterminate" type="checkbox" id="__nav_1" checked>
      
      
      
      
        <label class="md-nav__link" for="__nav_1">
          Getting Started
          <span class="md-nav__icon md-icon"></span>
        </label>
      
      <nav class="md-nav" aria-label="Getting Started" data-md-level="1">
        <label class="md-nav__title" for="__nav_1">
          <span class="md-nav__icon md-icon"></span>
          Getting Started
        </label>
        <ul class="md-nav__list" data-md-scrollfix>
          
            
              
  
  
  
    <li class="md-nav__item">
      <a href="../../../.." class="md-nav__link">
        Introduction
      </a>
    </li>
  

            
          
            
              
  
  
  
    <li class="md-nav__item">
      <a href="../../../../ABOUT_CN/" class="md-nav__link">
        About
      </a>
    </li>
  

            
          
        </ul>
      </nav>
    </li>
  

    
  </ul>
</nav>
                  </div>
                </div>
              </div>
            
            
          
          <div class="md-content" data-md-component="content">
            <article class="md-content__inner md-typeset">
              
                


<h1 id="linux">Linux 生产内核网络参数调优分析<a class="headerlink" href="#linux" title="Permanent link">&para;</a></h1>
<p>本文总结了常见的 Linux 内核参数及相关问题。修改内核参数前，您需要：</p>
<ul>
<li>从实际需要出发，最好有相关数据的支撑，不建议随意调整内核参数。</li>
<li>了解参数的具体作用，且注意同类型或版本环境的内核参数可能有所不同。</li>
</ul>
<h2 id="1-linux">1. 查看和修改 Linux 实例内核参数<a class="headerlink" href="#1-linux" title="Permanent link">&para;</a></h2>
<h3 id="11">1.1 方法一<a class="headerlink" href="#11" title="Permanent link">&para;</a></h3>
<blockquote>
<p>通过 <code>/proc/sys/</code> 目录</p>
</blockquote>
<ul>
<li>
<p>查看内核参数: 使用 <code>cat</code> 查看对应文件的内容，例如执行命令 <code>cat /proc/sys/net/ipv4/tcp_tw_recycle</code> 查看 <code>net.ipv4.tcp_tw_recycle</code> 的值。</p>
</li>
<li>
<p>修改内核参数: 使用 <code>echo</code> 修改内核参数对应的文件，例如执行命令 <code>echo "0" &gt; /proc/sys/net/ipv4/tcp_tw_recycle</code> 将 <code>net.ipv4.tcp_tw_recycle</code> 的值修改为 0。</p>
</li>
</ul>
<blockquote>
<p><strong>注意</strong>：
*   <code>/proc/sys/</code> 目录是 Linux 内核在启动后生成的伪目录，其目录下的 <code>net</code> 文件夹中存放了当前系统中开启的所有内核参数、目录树结构与参数的完整名称相关，如 <code>net.ipv4.tcp_tw_recycle</code>，它对应的文件是 <code>/proc/sys/net/ipv4/tcp_tw_recycle</code>，文件的内容就是参数值。
*   <a href="https://help.aliyun.com/knowledge_detail/41334.html#method1">方法一</a> 修改的参数值仅在当次运行中生效，系统重启后会回滚历史值，一般用于临时性的验证修改的效果。若需要永久性修改，请参阅 <a href="#方法二">方法二</a>(https://help.aliyun.com/knowledge_detail/41334.html#method2)。</p>
</blockquote>
<h3 id="12">1.2 方法二<a class="headerlink" href="#12" title="Permanent link">&para;</a></h3>
<blockquote>
<p>通过 <code>sysctl.conf</code> 文件</p>
</blockquote>
<ul>
<li>
<p>查看内核参数: 执行命令 <code>sysctl -a</code> 查看当前系统中生效的所有参数。</p>
</li>
<li>
<p>修改内核参数:</p>
</li>
<li>
<p>执行命令 <code>/sbin/sysctl -w kernel.parameter="example"</code> 修改参数，如<code>sysctl -w net.ipv4.tcp_tw_recycle="0"</code>。</p>
</li>
<li>执行命令 <code>vi /etc/sysctl.conf</code> 修改 <code>/etc/sysctl.conf</code> 文件中的参数。</li>
<li>执行命令 <code>/sbin/sysctl -p</code> 使配置生效。</li>
</ul>
<blockquote>
<p><strong>注</strong>：调整内核参数后内核处于不稳定状态，请务必重启实例。</p>
</blockquote>
<h2 id="2-linux">2. Linux 网络相关内核参数引发的常见问题及处理<a class="headerlink" href="#2-linux" title="Permanent link">&para;</a></h2>
<h3 id="21-linux-nat">2.1 Linux 实例 NAT 哈希表满导致丢包<a class="headerlink" href="#21-linux-nat" title="Permanent link">&para;</a></h3>
<p>此处涉及的内核参数：</p>
<div class="highlight"><pre><span></span><code><a id="__codelineno-0-1" name="__codelineno-0-1"></a><a href="#__codelineno-0-1"><span class="linenos" data-linenos="1 "></span></a>net.netfilter.nf_conntrack_buckets
<a id="__codelineno-0-2" name="__codelineno-0-2"></a><a href="#__codelineno-0-2"><span class="linenos" data-linenos="2 "></span></a>net.nf_conntrack_max
</code></pre></div>
<h4 id="211">2.1.1 问题现象<a class="headerlink" href="#211" title="Permanent link">&para;</a></h4>
<p>Linux 实例出现间歇性丢包，无法连接实例，通过 <a href="https://help.aliyun.com/document_detail/40573.html">tracert、mtr</a> 等工具排查，外部网络未见异常。同时，如下图所示，在系统日志中重复出现大量（<code>table full, dropping packet.</code>）错误信息。</p>
<div class="highlight"><pre><span></span><code><a id="__codelineno-1-1" name="__codelineno-1-1"></a><a href="#__codelineno-1-1"><span class="linenos" data-linenos="1 "></span></a>Feb  6  16:05:07 i-*** kernel: nf_conntrack: table full, dropping packet.
</code></pre></div>
<h4 id="212">2.1.2 原因分析<a class="headerlink" href="#212" title="Permanent link">&para;</a></h4>
<p>ip_conntrack 是 Linux 系统内 NAT 的一个跟踪连接条目的模块。ip_conntrack 模块会使用一个哈希表记录 TCP 协议 established connection 记录，当这个哈希表满了的时候，便会导致 <code>nf_conntrack: table full, dropping packet</code> 错误。Linux 系统会开辟一个空间用来维护每一个 TCP 链接，这个空间的大小与 <code>nf_conntrack_buckets</code>、<code>nf_conntrack_max</code> 相关，后者的默认值是前者的 4 倍，而前者在系统启动后无法修改，所以一般都是建议调大 <code>nf_conntrack_max</code>。</p>
<blockquote>
<p><strong>注意</strong>：系统维护连接比较消耗内存，请在系统空闲和内存充足的情况下调大 <code>nf_conntrack_max</code>，且根据系统的情况而定。</p>
</blockquote>
<h4 id="213">2.1.3 决思路<a class="headerlink" href="#213" title="Permanent link">&para;</a></h4>
<ol>
<li>使用<a href="https://help.aliyun.com/document_detail/38006.html">管理终端</a>登录实例。</li>
<li>
<p>执行命令 <code># vi /etc/sysctl.conf</code> 编辑系统内核配置。</p>
</li>
<li>
<p>修改哈希表项最大值参数：<code>net.netfilter.nf_conntrack_max = 655350</code>。</p>
</li>
<li>修改超时参数：<code>net.netfilter.nf_conntrack_tcp_timeout_established = 1200</code>，默认情况下 timeout 是 432000（秒）。</li>
<li>执行命令 <code># sysctl -p</code> 使配置生效。</li>
</ol>
<h3 id="22-time-wait-bucket-table-overflow">2.2 Time wait bucket table overflow 报错<a class="headerlink" href="#22-time-wait-bucket-table-overflow" title="Permanent link">&para;</a></h3>
<p>此处涉及的内核参数：</p>
<ul>
<li><code>net.ipv4.tcp_max_tw_buckets</code></li>
</ul>
<h4 id="221">2.2.1 问题现象<a class="headerlink" href="#221" title="Permanent link">&para;</a></h4>
<p>Linux 实例 <code>/var/log/message</code> 日志全是类似 <code>kernel: TCP: time wait bucket table overflow</code> 的报错信息，提示 <code>time wait bucket table</code> 溢出，如下：</p>
<div class="highlight"><pre><span></span><code><a id="__codelineno-2-1" name="__codelineno-2-1"></a><a href="#__codelineno-2-1"><span class="linenos" data-linenos="1 "></span></a>Feb  18  12:28:38 i-*** kernel: TCP: time wait bucket table overflow
<a id="__codelineno-2-2" name="__codelineno-2-2"></a><a href="#__codelineno-2-2"><span class="linenos" data-linenos="2 "></span></a>Feb  18  12:28:44 i-*** kernel: printk:  227 messages suppressed.
</code></pre></div>
<p>执行命令 <code>netstat -ant|grep TIME_WAIT|wc -l</code> 统计处于 TIME_WAIT 状态的 TCP 连接数，发现处于 TIME_WAIT 状态的 TCP 连接非常多。</p>
<h4 id="222">2.2.2 原因分析<a class="headerlink" href="#222" title="Permanent link">&para;</a></h4>
<p>参数 <code>net.ipv4.tcp_max_tw_buckets</code> 可以调整内核中管理 TIME_WAIT 状态的数量，当实例中处于 TIME_WAIT 及需要转换为 TIME_WAIT 状态连接数之和超过了 <code>net.ipv4.tcp_max_tw_buckets</code> 参数值时，message 日志中将报错 <code>time wait bucket table</code>，同时内核关闭超出参数值的部分 TCP 连接。您需要根据实际情况适当调高 <code>net.ipv4.tcp_max_tw_buckets</code>，同时从业务层面去改进 TCP 连接。</p>
<h4 id="223">2.2.3 解决思路<a class="headerlink" href="#223" title="Permanent link">&para;</a></h4>
<ol>
<li>
<p>执行命令 <code>netstat -anp |grep tcp |wc -l</code> 统计 TCP 连接数。</p>
</li>
<li>
<p>执行命令 <code>vi /etc/sysctl.conf</code>，查询 <code>net.ipv4.tcp_max_tw_buckets</code> 参数。如果确认连接使用很高，容易超出限制。</p>
</li>
<li>
<p>调高参数 <code>net.ipv4.tcp_max_tw_buckets</code>，扩大限制。</p>
</li>
<li>
<p>执行命令 <code># sysctl -p</code> 使配置生效。</p>
</li>
</ol>
<h3 id="23-linux-fin_wait2-tcp">2.3 Linux 实例中 FIN_WAIT2 状态的 TCP 链接过多<a class="headerlink" href="#23-linux-fin_wait2-tcp" title="Permanent link">&para;</a></h3>
<p>此处涉及的内核参数：</p>
<ul>
<li><code>net.ipv4.tcp_fin_timeout</code></li>
</ul>
<h4 id="231">2.3.1 问题现象<a class="headerlink" href="#231" title="Permanent link">&para;</a></h4>
<p>FIN_WAIT2 状态的 TCP 链接过多。</p>
<h4 id="232">2.3.2 原因分析<a class="headerlink" href="#232" title="Permanent link">&para;</a></h4>
<ul>
<li>HTTP 服务中，Server 由于某种原因会主动关闭连接，例如 KEEPALIVE 超时的情况下。作为主动关闭连接的 Server 就会进入 FIN_WAIT2 状态。</li>
<li>TCP/IP 协议栈中，存在<strong>半连接</strong>的概念，FIN_WAIT2 状态不算做超时，如果 Client 不关闭，FIN_WAIT_2 状态将保持到系统重启，越来越多的 FIN_WAIT_2 状态会致使内核 Crash。</li>
<li>建议调小 <code>net.ipv4.tcp_fin_timeout</code> 参数，减少这个数值以便加快系统关闭处于 <code>FIN_WAIT2</code> 状态的 TCP 连接。</li>
</ul>
<h4 id="233">2.3.3 解决思路<a class="headerlink" href="#233" title="Permanent link">&para;</a></h4>
<ul>
<li>执行命令 <code>vi /etc/sysctl.conf</code>，修改或加入以下内容：</li>
</ul>
<div class="highlight"><pre><span></span><code><a id="__codelineno-3-1" name="__codelineno-3-1"></a><a href="#__codelineno-3-1"><span class="linenos" data-linenos="1 "></span></a>net.ipv4.tcp_syncookies = 1
<a id="__codelineno-3-2" name="__codelineno-3-2"></a><a href="#__codelineno-3-2"><span class="linenos" data-linenos="2 "></span></a>net.ipv4.tcp_fin_timeout = 30
<a id="__codelineno-3-3" name="__codelineno-3-3"></a><a href="#__codelineno-3-3"><span class="linenos" data-linenos="3 "></span></a>net.ipv4.tcp_max_syn_backlog = 8192
<a id="__codelineno-3-4" name="__codelineno-3-4"></a><a href="#__codelineno-3-4"><span class="linenos" data-linenos="4 "></span></a>net.ipv4.tcp_max_tw_buckets = 5000
</code></pre></div>
<ul>
<li>执行命令 <code># sysctl -p</code> 使配置生效。</li>
</ul>
<blockquote>
<p><strong>注</strong>：由于 <code>FIN_WAIT2</code> 状态的 TCP 连接会进入 <code>TIME_WAIT</code> 状态，请同时参阅 <a href="https://help.aliyun.com/knowledge_detail/41334.html#TimeWaitBucket">time wait bucket table overflow 报错</a>。</p>
</blockquote>
<h3 id="24-linux-close_wait-tcp">2.4 Linux 实例中出现大量 CLOSE_WAIT 状态的 TCP 连接<a class="headerlink" href="#24-linux-close_wait-tcp" title="Permanent link">&para;</a></h3>
<h4 id="241">2.4.1 问题现象<a class="headerlink" href="#241" title="Permanent link">&para;</a></h4>
<p>执行命令 <code>netstat -atn|grep CLOSE_WAIT|wc -l</code> 发现当前系统中处于 <code>CLOSE_WAIT</code> 状态的 TCP 连接非常多。</p>
<h4 id="242">2.4.2 原因分析<a class="headerlink" href="#242" title="Permanent link">&para;</a></h4>
<p>关闭 TCP 连接时，TCP 连接的两端都可以发起关闭连接的请求，若对端发起了关闭连接，但本地没有关闭连接，那么该连接就会处于 CLOSE_WAIT 状态。虽然该连接已经处于半开状态，但是已经无法和对端通信，需要及时的释放掉该链接。建议从业务层面及时判断某个连接是否已经被对端关闭，即在程序逻辑中对连接及时关闭检查。</p>
<h4 id="243">2.4.3 解决思路<a class="headerlink" href="#243" title="Permanent link">&para;</a></h4>
<p>编程语言中对应的读、写函数一般包含了检测 CLOSE_WAIT TCP 连接功能，例如：</p>
<p><strong>Java 语言</strong>：</p>
<ol>
<li>通过 <code>read</code> 方法来判断 I/O 。当 read 方法返回 <code>-1</code> 时则表示已经到达末尾。</li>
<li>通过 <code>close</code> 方法关闭该链接。</li>
</ol>
<p><strong>C 语言</strong>：</p>
<ol>
<li>检查 <code>read</code> 的返回值。<ul>
<li>若等于 0 则可以关闭该连接。</li>
<li>若小于 0 则查看 errno，若不是 AGAIN 则同样可以关闭连接。</li>
</ul>
</li>
</ol>
<h3 id="25-nat-ecs-rds">2.5 客户端配置 NAT 后仍无法访问 ECS 或 RDS 远端服务器<a class="headerlink" href="#25-nat-ecs-rds" title="Permanent link">&para;</a></h3>
<p>此处涉及的内核参数：</p>
<ul>
<li><code>net.ipv4.tcp_tw_recycle</code></li>
<li><code>net.ipv4.tcp_timestamps</code></li>
</ul>
<h4 id="251">2.5.1 问题现象<a class="headerlink" href="#251" title="Permanent link">&para;</a></h4>
<p>客户端配置 NAT 后无法访问远端 ECS、RDS，包括配置了 SNAT 的 VPC ECS 。同时无法访问连接其他 ECS 或 RDS 等云产品，抓包检测发现远端对客户端发送的 SYN 包没有响应。</p>
<h4 id="252">2.5.2 原因分析<a class="headerlink" href="#252" title="Permanent link">&para;</a></h4>
<p>若远端服务器的内核参数 <code>net.ipv4.tcp_tw_recycle</code> 和 <code>net.ipv4.tcp_timestamps</code> 的值都为 1，则远端服务器会检查每一个报文中的时间戳（Timestamp），若 Timestamp 不是递增的关系，不会响应这个报文。配置 NAT 后，远端服务器看到来自不同的客户端的源 IP 相同，但 NAT 前每一台客户端的时间可能会有偏差，报文中的 Timestamp 就不是递增的情况。</p>
<h4 id="253">2.5.3 解决思路<a class="headerlink" href="#253" title="Permanent link">&para;</a></h4>
<ul>
<li>远端服务器为 ECS 时，修改参数 <code>net.ipv4.tcp_tw_recycle</code> 为 0。</li>
<li>远端服务器为 RDS 等 PaaS 服务时。RDS 无法直接修改内核参数，需要在客户端上修改参数 <code>net.ipv4.tcp_tw_recycle</code> 和 <code>net.ipv4.tcp_timestamps</code> 为 0。</li>
</ul>
<h2 id="3-linux">3. 总结, 以上涉及 Linux 内核参数说明<a class="headerlink" href="#3-linux" title="Permanent link">&para;</a></h2>
<table>
<thead>
<tr>
<th>参数</th>
<th>说明</th>
</tr>
</thead>
<tbody>
<tr>
<td>net.ipv4.tcp_max_syn_backlog</td>
<td>该参数决定了系统中处于 <code>SYN_RECV</code> 状态的 TCP 连接数量。<code>SYN_RECV</code> 状态指的是当系统收到 SYN 后，作了 SYN+ACK 响应后等待对方回复三次握手阶段中的最后一个 ACK 的阶段。</td>
</tr>
<tr>
<td>net.ipv4.tcp_syncookies</td>
<td>该参数表示是否打开 TCP 同步标签（<code>SYN_COOKIES</code>），内核必须开启并编译 CONFIG_SYN_COOKIES，<code>SYN_COOKIES</code> 可以防止一个套接字在有过多试图连接到达时引起过载。默认值 0 表示关闭。当该参数被设置为 1 且 <code>SYN_RECV</code> 队列满了之后，内核会对 SYN 包的回复做一定的修改，即，在响应的 SYN+ACK 包中，初始的序列号是由源 IP + Port、目的 IP + Port 及时间这五个参数共同计算出一个值组成精心组装的 TCP 包。由于 ACK 包中确认的序列号并不是之前计算出的值，恶意攻击者无法响应或误判，而请求者会根据收到的 SYN+ACK 包做正确的响应。启用 <code>net.ipv4.tcp_syncookies</code> 后，会忽略 <code>net.ipv4.tcp_max_syn_backlog</code>。</td>
</tr>
<tr>
<td>net.ipv4.tcp_synack_retries</td>
<td>该参数指明了处于 <code>SYN_RECV</code> 状态时重传 SYN+ACK 包的次数。</td>
</tr>
<tr>
<td>net.ipv4.tcp_abort_on_overflow</td>
<td>设置该参数为 1 时，当系统在短时间内收到了大量的请求，而相关的应用程序未能处理时，就会发送 Reset 包直接终止这些链接。建议通过优化应用程序的效率来提高处理能力，而不是简单地 Reset。默认值： 0</td>
</tr>
<tr>
<td>net.core.somaxconn</td>
<td>该参数定义了系统中每一个端口最大的监听队列的长度，是个全局参数。该参数和 <code>net.ipv4.tcp_max_syn_backlog</code> 有关联，后者指的是还在三次握手的半连接的上限，该参数指的是处于 ESTABLISHED 的数量上限。若您的 ECS 实例业务负载很高，则有必要调高该参数。<code>listen(2)</code> 函数中的参数 <code>backlog</code> 同样是指明监听的端口处于 ESTABLISHED 的数量上限，当 <code>backlog</code> 大于 <code>net.core.somaxconn</code>时，以 <code>net.core.somaxconn</code> 参数为准。</td>
</tr>
<tr>
<td>net.core.netdev_max_backlog</td>
<td>当内核处理速度比网卡接收速度慢时，这部分多出来的包就会被保存在网卡的接收队列上，而该参数说明了这个队列的数量上限。</td>
</tr>
</tbody>
</table>
<h2 id="4">4. 生产集群内核配置参考<a class="headerlink" href="#4" title="Permanent link">&para;</a></h2>
<ul>
<li>4.1 参考1: 笔者所在公司的 Iot 生产环境 <code>EMQ</code> 集群的 <code>sysctl.conf</code> 配置 (CentOS 7.4 4C 32G)</li>
</ul>
<div class="highlight"><pre><span></span><code><a id="__codelineno-4-1" name="__codelineno-4-1"></a><a href="#__codelineno-4-1"><span class="linenos" data-linenos=" 1 "></span></a># see: https://www.kernel.org/doc/Documentation/sysctl
<a id="__codelineno-4-2" name="__codelineno-4-2"></a><a href="#__codelineno-4-2"><span class="linenos" data-linenos=" 2 "></span></a>
<a id="__codelineno-4-3" name="__codelineno-4-3"></a><a href="#__codelineno-4-3"><span class="linenos" data-linenos=" 3 "></span></a>fs.file-max = 1048576
<a id="__codelineno-4-4" name="__codelineno-4-4"></a><a href="#__codelineno-4-4"><span class="linenos" data-linenos=" 4 "></span></a>fs.nr_open = 2097152
<a id="__codelineno-4-5" name="__codelineno-4-5"></a><a href="#__codelineno-4-5"><span class="linenos" data-linenos=" 5 "></span></a>
<a id="__codelineno-4-6" name="__codelineno-4-6"></a><a href="#__codelineno-4-6"><span class="linenos" data-linenos=" 6 "></span></a>net.core.somaxconn = 32768
<a id="__codelineno-4-7" name="__codelineno-4-7"></a><a href="#__codelineno-4-7"><span class="linenos" data-linenos=" 7 "></span></a>net.core.rmem_default = 262144
<a id="__codelineno-4-8" name="__codelineno-4-8"></a><a href="#__codelineno-4-8"><span class="linenos" data-linenos=" 8 "></span></a>net.core.wmem_default = 262144
<a id="__codelineno-4-9" name="__codelineno-4-9"></a><a href="#__codelineno-4-9"><span class="linenos" data-linenos=" 9 "></span></a>net.core.rmem_max = 16777216
<a id="__codelineno-4-10" name="__codelineno-4-10"></a><a href="#__codelineno-4-10"><span class="linenos" data-linenos="10 "></span></a>net.core.wmem_max = 16777216
<a id="__codelineno-4-11" name="__codelineno-4-11"></a><a href="#__codelineno-4-11"><span class="linenos" data-linenos="11 "></span></a>net.core.netdev_max_backlog = 8192
<a id="__codelineno-4-12" name="__codelineno-4-12"></a><a href="#__codelineno-4-12"><span class="linenos" data-linenos="12 "></span></a>
<a id="__codelineno-4-13" name="__codelineno-4-13"></a><a href="#__codelineno-4-13"><span class="linenos" data-linenos="13 "></span></a>net.ipv4.tcp_mem = 378798 505064 757596
<a id="__codelineno-4-14" name="__codelineno-4-14"></a><a href="#__codelineno-4-14"><span class="linenos" data-linenos="14 "></span></a>net.ipv4.tcp_rmem = 1024 4096 16777216
<a id="__codelineno-4-15" name="__codelineno-4-15"></a><a href="#__codelineno-4-15"><span class="linenos" data-linenos="15 "></span></a>net.ipv4.tcp_wmem = 1024 4096 16777216
<a id="__codelineno-4-16" name="__codelineno-4-16"></a><a href="#__codelineno-4-16"><span class="linenos" data-linenos="16 "></span></a>net.ipv4.tcp_max_tw_buckets = 5000
<a id="__codelineno-4-17" name="__codelineno-4-17"></a><a href="#__codelineno-4-17"><span class="linenos" data-linenos="17 "></span></a>net.ipv4.tcp_fin_timeout = 15
<a id="__codelineno-4-18" name="__codelineno-4-18"></a><a href="#__codelineno-4-18"><span class="linenos" data-linenos="18 "></span></a>net.ipv4.tcp_tw_recycle = 0
<a id="__codelineno-4-19" name="__codelineno-4-19"></a><a href="#__codelineno-4-19"><span class="linenos" data-linenos="19 "></span></a>net.ipv4.tcp_tw_reuse = 0
<a id="__codelineno-4-20" name="__codelineno-4-20"></a><a href="#__codelineno-4-20"><span class="linenos" data-linenos="20 "></span></a>net.ipv4.tcp_max_syn_backlog = 8192
<a id="__codelineno-4-21" name="__codelineno-4-21"></a><a href="#__codelineno-4-21"><span class="linenos" data-linenos="21 "></span></a>net.ipv4.ip_local_port_range = 1024  65000
<a id="__codelineno-4-22" name="__codelineno-4-22"></a><a href="#__codelineno-4-22"><span class="linenos" data-linenos="22 "></span></a>
<a id="__codelineno-4-23" name="__codelineno-4-23"></a><a href="#__codelineno-4-23"><span class="linenos" data-linenos="23 "></span></a>net.nf_conntrack_max = 262144
<a id="__codelineno-4-24" name="__codelineno-4-24"></a><a href="#__codelineno-4-24"><span class="linenos" data-linenos="24 "></span></a>
<a id="__codelineno-4-25" name="__codelineno-4-25"></a><a href="#__codelineno-4-25"><span class="linenos" data-linenos="25 "></span></a>net.netfilter.nf_conntrack_max = 262144
<a id="__codelineno-4-26" name="__codelineno-4-26"></a><a href="#__codelineno-4-26"><span class="linenos" data-linenos="26 "></span></a>net.netfilter.nf_conntrack_tcp_timeout_close_wait = 60
<a id="__codelineno-4-27" name="__codelineno-4-27"></a><a href="#__codelineno-4-27"><span class="linenos" data-linenos="27 "></span></a>net.netfilter.nf_conntrack_tcp_timeout_time_wait = 30
</code></pre></div>
<ul>
<li>4.2 参考2: 感谢 <a href="https://github.com/lework/kainstall/blob/v1.4.5/kainstall-centos.sh#L370">lework/kainstall</a> 的作者, 基于纯<code>shell</code>的 <a href="https://kubernetes.io/zh/docs/setup/production-environment/tools/">kubernetes</a> 生产集群的 <code>sysctl</code> 配置</li>
</ul>
<div class="highlight"><pre><span></span><code><a id="__codelineno-5-1" name="__codelineno-5-1"></a><a href="#__codelineno-5-1"><span class="linenos" data-linenos="  1 "></span></a># see: https://www.kernel.org/doc/Documentation/sysctl
<a id="__codelineno-5-2" name="__codelineno-5-2"></a><a href="#__codelineno-5-2"><span class="linenos" data-linenos="  2 "></span></a>#############################################################################################
<a id="__codelineno-5-3" name="__codelineno-5-3"></a><a href="#__codelineno-5-3"><span class="linenos" data-linenos="  3 "></span></a># 调整虚拟内存
<a id="__codelineno-5-4" name="__codelineno-5-4"></a><a href="#__codelineno-5-4"><span class="linenos" data-linenos="  4 "></span></a>#############################################################################################
<a id="__codelineno-5-5" name="__codelineno-5-5"></a><a href="#__codelineno-5-5"><span class="linenos" data-linenos="  5 "></span></a>
<a id="__codelineno-5-6" name="__codelineno-5-6"></a><a href="#__codelineno-5-6"><span class="linenos" data-linenos="  6 "></span></a># Default: 30
<a id="__codelineno-5-7" name="__codelineno-5-7"></a><a href="#__codelineno-5-7"><span class="linenos" data-linenos="  7 "></span></a># 0 - 任何情况下都不使用swap。
<a id="__codelineno-5-8" name="__codelineno-5-8"></a><a href="#__codelineno-5-8"><span class="linenos" data-linenos="  8 "></span></a># 1 - 除非内存不足（OOM），否则不使用swap。
<a id="__codelineno-5-9" name="__codelineno-5-9"></a><a href="#__codelineno-5-9"><span class="linenos" data-linenos="  9 "></span></a>vm.swappiness = 0
<a id="__codelineno-5-10" name="__codelineno-5-10"></a><a href="#__codelineno-5-10"><span class="linenos" data-linenos=" 10 "></span></a>
<a id="__codelineno-5-11" name="__codelineno-5-11"></a><a href="#__codelineno-5-11"><span class="linenos" data-linenos=" 11 "></span></a># 内存分配策略
<a id="__codelineno-5-12" name="__codelineno-5-12"></a><a href="#__codelineno-5-12"><span class="linenos" data-linenos=" 12 "></span></a>#0 - 表示内核将检查是否有足够的可用内存供应用进程使用；如果有足够的可用内存，内存申请允许；否则，内存申请失败，并把错误返回给应用进程。
<a id="__codelineno-5-13" name="__codelineno-5-13"></a><a href="#__codelineno-5-13"><span class="linenos" data-linenos=" 13 "></span></a>#1 - 表示内核允许分配所有的物理内存，而不管当前的内存状态如何。
<a id="__codelineno-5-14" name="__codelineno-5-14"></a><a href="#__codelineno-5-14"><span class="linenos" data-linenos=" 14 "></span></a>#2 - 表示内核允许分配超过所有物理内存和交换空间总和的内存
<a id="__codelineno-5-15" name="__codelineno-5-15"></a><a href="#__codelineno-5-15"><span class="linenos" data-linenos=" 15 "></span></a>vm.overcommit_memory=1
<a id="__codelineno-5-16" name="__codelineno-5-16"></a><a href="#__codelineno-5-16"><span class="linenos" data-linenos=" 16 "></span></a>
<a id="__codelineno-5-17" name="__codelineno-5-17"></a><a href="#__codelineno-5-17"><span class="linenos" data-linenos=" 17 "></span></a># OOM时处理
<a id="__codelineno-5-18" name="__codelineno-5-18"></a><a href="#__codelineno-5-18"><span class="linenos" data-linenos=" 18 "></span></a># 1关闭，等于0时，表示当内存耗尽时，内核会触发OOM killer杀掉最耗内存的进程。
<a id="__codelineno-5-19" name="__codelineno-5-19"></a><a href="#__codelineno-5-19"><span class="linenos" data-linenos=" 19 "></span></a>vm.panic_on_oom=0
<a id="__codelineno-5-20" name="__codelineno-5-20"></a><a href="#__codelineno-5-20"><span class="linenos" data-linenos=" 20 "></span></a>
<a id="__codelineno-5-21" name="__codelineno-5-21"></a><a href="#__codelineno-5-21"><span class="linenos" data-linenos=" 21 "></span></a># vm.dirty_background_ratio 用于调整内核如何处理必须刷新到磁盘的脏页。
<a id="__codelineno-5-22" name="__codelineno-5-22"></a><a href="#__codelineno-5-22"><span class="linenos" data-linenos=" 22 "></span></a># Default value is 10.
<a id="__codelineno-5-23" name="__codelineno-5-23"></a><a href="#__codelineno-5-23"><span class="linenos" data-linenos=" 23 "></span></a># 该值是系统内存总量的百分比，在许多情况下将此值设置为5是合适的。
<a id="__codelineno-5-24" name="__codelineno-5-24"></a><a href="#__codelineno-5-24"><span class="linenos" data-linenos=" 24 "></span></a># 此设置不应设置为零。
<a id="__codelineno-5-25" name="__codelineno-5-25"></a><a href="#__codelineno-5-25"><span class="linenos" data-linenos=" 25 "></span></a>vm.dirty_background_ratio = 5
<a id="__codelineno-5-26" name="__codelineno-5-26"></a><a href="#__codelineno-5-26"><span class="linenos" data-linenos=" 26 "></span></a>
<a id="__codelineno-5-27" name="__codelineno-5-27"></a><a href="#__codelineno-5-27"><span class="linenos" data-linenos=" 27 "></span></a># 内核强制同步操作将其刷新到磁盘之前允许的脏页总数
<a id="__codelineno-5-28" name="__codelineno-5-28"></a><a href="#__codelineno-5-28"><span class="linenos" data-linenos=" 28 "></span></a># 也可以通过更改 vm.dirty_ratio 的值（将其增加到默认值30以上（也占系统内存的百分比））来增加
<a id="__codelineno-5-29" name="__codelineno-5-29"></a><a href="#__codelineno-5-29"><span class="linenos" data-linenos=" 29 "></span></a># 推荐 vm.dirty_ratio 的值在60到80之间。
<a id="__codelineno-5-30" name="__codelineno-5-30"></a><a href="#__codelineno-5-30"><span class="linenos" data-linenos=" 30 "></span></a>vm.dirty_ratio = 60
<a id="__codelineno-5-31" name="__codelineno-5-31"></a><a href="#__codelineno-5-31"><span class="linenos" data-linenos=" 31 "></span></a>
<a id="__codelineno-5-32" name="__codelineno-5-32"></a><a href="#__codelineno-5-32"><span class="linenos" data-linenos=" 32 "></span></a># vm.max_map_count 计算当前的内存映射文件数。
<a id="__codelineno-5-33" name="__codelineno-5-33"></a><a href="#__codelineno-5-33"><span class="linenos" data-linenos=" 33 "></span></a># mmap 限制（vm.max_map_count）的最小值是打开文件的ulimit数量（cat /proc/sys/fs/file-max）。
<a id="__codelineno-5-34" name="__codelineno-5-34"></a><a href="#__codelineno-5-34"><span class="linenos" data-linenos=" 34 "></span></a># 每128KB系统内存 map_count应该大约为1。 因此，在32GB系统上，max_map_count为262144。
<a id="__codelineno-5-35" name="__codelineno-5-35"></a><a href="#__codelineno-5-35"><span class="linenos" data-linenos=" 35 "></span></a># Default: 65530
<a id="__codelineno-5-36" name="__codelineno-5-36"></a><a href="#__codelineno-5-36"><span class="linenos" data-linenos=" 36 "></span></a>vm.max_map_count = 2097152
<a id="__codelineno-5-37" name="__codelineno-5-37"></a><a href="#__codelineno-5-37"><span class="linenos" data-linenos=" 37 "></span></a>
<a id="__codelineno-5-38" name="__codelineno-5-38"></a><a href="#__codelineno-5-38"><span class="linenos" data-linenos=" 38 "></span></a>#############################################################################################
<a id="__codelineno-5-39" name="__codelineno-5-39"></a><a href="#__codelineno-5-39"><span class="linenos" data-linenos=" 39 "></span></a># 调整文件
<a id="__codelineno-5-40" name="__codelineno-5-40"></a><a href="#__codelineno-5-40"><span class="linenos" data-linenos=" 40 "></span></a>#############################################################################################
<a id="__codelineno-5-41" name="__codelineno-5-41"></a><a href="#__codelineno-5-41"><span class="linenos" data-linenos=" 41 "></span></a>
<a id="__codelineno-5-42" name="__codelineno-5-42"></a><a href="#__codelineno-5-42"><span class="linenos" data-linenos=" 42 "></span></a>fs.may_detach_mounts = 1
<a id="__codelineno-5-43" name="__codelineno-5-43"></a><a href="#__codelineno-5-43"><span class="linenos" data-linenos=" 43 "></span></a>
<a id="__codelineno-5-44" name="__codelineno-5-44"></a><a href="#__codelineno-5-44"><span class="linenos" data-linenos=" 44 "></span></a># 增加文件句柄和inode缓存的大小，并限制核心转储。
<a id="__codelineno-5-45" name="__codelineno-5-45"></a><a href="#__codelineno-5-45"><span class="linenos" data-linenos=" 45 "></span></a>fs.file-max = 2097152
<a id="__codelineno-5-46" name="__codelineno-5-46"></a><a href="#__codelineno-5-46"><span class="linenos" data-linenos=" 46 "></span></a>fs.nr_open = 2097152
<a id="__codelineno-5-47" name="__codelineno-5-47"></a><a href="#__codelineno-5-47"><span class="linenos" data-linenos=" 47 "></span></a>fs.suid_dumpable = 0
<a id="__codelineno-5-48" name="__codelineno-5-48"></a><a href="#__codelineno-5-48"><span class="linenos" data-linenos=" 48 "></span></a>
<a id="__codelineno-5-49" name="__codelineno-5-49"></a><a href="#__codelineno-5-49"><span class="linenos" data-linenos=" 49 "></span></a># 文件监控
<a id="__codelineno-5-50" name="__codelineno-5-50"></a><a href="#__codelineno-5-50"><span class="linenos" data-linenos=" 50 "></span></a>fs.inotify.max_user_instances=8192
<a id="__codelineno-5-51" name="__codelineno-5-51"></a><a href="#__codelineno-5-51"><span class="linenos" data-linenos=" 51 "></span></a>fs.inotify.max_user_watches=524288
<a id="__codelineno-5-52" name="__codelineno-5-52"></a><a href="#__codelineno-5-52"><span class="linenos" data-linenos=" 52 "></span></a>fs.inotify.max_queued_events=16384
<a id="__codelineno-5-53" name="__codelineno-5-53"></a><a href="#__codelineno-5-53"><span class="linenos" data-linenos=" 53 "></span></a>
<a id="__codelineno-5-54" name="__codelineno-5-54"></a><a href="#__codelineno-5-54"><span class="linenos" data-linenos=" 54 "></span></a>#############################################################################################
<a id="__codelineno-5-55" name="__codelineno-5-55"></a><a href="#__codelineno-5-55"><span class="linenos" data-linenos=" 55 "></span></a># 调整网络设置
<a id="__codelineno-5-56" name="__codelineno-5-56"></a><a href="#__codelineno-5-56"><span class="linenos" data-linenos=" 56 "></span></a>#############################################################################################
<a id="__codelineno-5-57" name="__codelineno-5-57"></a><a href="#__codelineno-5-57"><span class="linenos" data-linenos=" 57 "></span></a>
<a id="__codelineno-5-58" name="__codelineno-5-58"></a><a href="#__codelineno-5-58"><span class="linenos" data-linenos=" 58 "></span></a># 为每个套接字的发送和接收缓冲区分配的默认内存量。
<a id="__codelineno-5-59" name="__codelineno-5-59"></a><a href="#__codelineno-5-59"><span class="linenos" data-linenos=" 59 "></span></a>net.core.wmem_default = 25165824
<a id="__codelineno-5-60" name="__codelineno-5-60"></a><a href="#__codelineno-5-60"><span class="linenos" data-linenos=" 60 "></span></a>net.core.rmem_default = 25165824
<a id="__codelineno-5-61" name="__codelineno-5-61"></a><a href="#__codelineno-5-61"><span class="linenos" data-linenos=" 61 "></span></a>
<a id="__codelineno-5-62" name="__codelineno-5-62"></a><a href="#__codelineno-5-62"><span class="linenos" data-linenos=" 62 "></span></a># 为每个套接字的发送和接收缓冲区分配的最大内存量。
<a id="__codelineno-5-63" name="__codelineno-5-63"></a><a href="#__codelineno-5-63"><span class="linenos" data-linenos=" 63 "></span></a>net.core.wmem_max = 25165824
<a id="__codelineno-5-64" name="__codelineno-5-64"></a><a href="#__codelineno-5-64"><span class="linenos" data-linenos=" 64 "></span></a>net.core.rmem_max = 25165824
<a id="__codelineno-5-65" name="__codelineno-5-65"></a><a href="#__codelineno-5-65"><span class="linenos" data-linenos=" 65 "></span></a>
<a id="__codelineno-5-66" name="__codelineno-5-66"></a><a href="#__codelineno-5-66"><span class="linenos" data-linenos=" 66 "></span></a># 除了套接字设置外，发送和接收缓冲区的大小
<a id="__codelineno-5-67" name="__codelineno-5-67"></a><a href="#__codelineno-5-67"><span class="linenos" data-linenos=" 67 "></span></a># 必须使用net.ipv4.tcp_wmem和net.ipv4.tcp_rmem参数分别设置TCP套接字。
<a id="__codelineno-5-68" name="__codelineno-5-68"></a><a href="#__codelineno-5-68"><span class="linenos" data-linenos=" 68 "></span></a># 使用三个以空格分隔的整数设置这些整数，分别指定最小，默认和最大大小。
<a id="__codelineno-5-69" name="__codelineno-5-69"></a><a href="#__codelineno-5-69"><span class="linenos" data-linenos=" 69 "></span></a># 最大大小不能大于使用net.core.wmem_max和net.core.rmem_max为所有套接字指定的值。
<a id="__codelineno-5-70" name="__codelineno-5-70"></a><a href="#__codelineno-5-70"><span class="linenos" data-linenos=" 70 "></span></a># 合理的设置是最小4KiB，默认64KiB和最大2MiB缓冲区。
<a id="__codelineno-5-71" name="__codelineno-5-71"></a><a href="#__codelineno-5-71"><span class="linenos" data-linenos=" 71 "></span></a>net.ipv4.tcp_wmem = 20480 12582912 25165824
<a id="__codelineno-5-72" name="__codelineno-5-72"></a><a href="#__codelineno-5-72"><span class="linenos" data-linenos=" 72 "></span></a>net.ipv4.tcp_rmem = 20480 12582912 25165824
<a id="__codelineno-5-73" name="__codelineno-5-73"></a><a href="#__codelineno-5-73"><span class="linenos" data-linenos=" 73 "></span></a>
<a id="__codelineno-5-74" name="__codelineno-5-74"></a><a href="#__codelineno-5-74"><span class="linenos" data-linenos=" 74 "></span></a># 增加最大可分配的总缓冲区空间
<a id="__codelineno-5-75" name="__codelineno-5-75"></a><a href="#__codelineno-5-75"><span class="linenos" data-linenos=" 75 "></span></a># 以页为单位（4096字节）进行度量
<a id="__codelineno-5-76" name="__codelineno-5-76"></a><a href="#__codelineno-5-76"><span class="linenos" data-linenos=" 76 "></span></a>net.ipv4.tcp_mem = 65536 25165824 262144
<a id="__codelineno-5-77" name="__codelineno-5-77"></a><a href="#__codelineno-5-77"><span class="linenos" data-linenos=" 77 "></span></a>net.ipv4.udp_mem = 65536 25165824 262144
<a id="__codelineno-5-78" name="__codelineno-5-78"></a><a href="#__codelineno-5-78"><span class="linenos" data-linenos=" 78 "></span></a>
<a id="__codelineno-5-79" name="__codelineno-5-79"></a><a href="#__codelineno-5-79"><span class="linenos" data-linenos=" 79 "></span></a># 为每个套接字的发送和接收缓冲区分配的最小内存量。
<a id="__codelineno-5-80" name="__codelineno-5-80"></a><a href="#__codelineno-5-80"><span class="linenos" data-linenos=" 80 "></span></a>net.ipv4.udp_wmem_min = 16384
<a id="__codelineno-5-81" name="__codelineno-5-81"></a><a href="#__codelineno-5-81"><span class="linenos" data-linenos=" 81 "></span></a>net.ipv4.udp_rmem_min = 16384
<a id="__codelineno-5-82" name="__codelineno-5-82"></a><a href="#__codelineno-5-82"><span class="linenos" data-linenos=" 82 "></span></a>
<a id="__codelineno-5-83" name="__codelineno-5-83"></a><a href="#__codelineno-5-83"><span class="linenos" data-linenos=" 83 "></span></a># 启用TCP窗口缩放，客户端可以更有效地传输数据，并允许在代理方缓冲该数据。
<a id="__codelineno-5-84" name="__codelineno-5-84"></a><a href="#__codelineno-5-84"><span class="linenos" data-linenos=" 84 "></span></a>net.ipv4.tcp_window_scaling = 1
<a id="__codelineno-5-85" name="__codelineno-5-85"></a><a href="#__codelineno-5-85"><span class="linenos" data-linenos=" 85 "></span></a>
<a id="__codelineno-5-86" name="__codelineno-5-86"></a><a href="#__codelineno-5-86"><span class="linenos" data-linenos=" 86 "></span></a># 提高同时接受连接数。
<a id="__codelineno-5-87" name="__codelineno-5-87"></a><a href="#__codelineno-5-87"><span class="linenos" data-linenos=" 87 "></span></a>net.ipv4.tcp_max_syn_backlog = 10240
<a id="__codelineno-5-88" name="__codelineno-5-88"></a><a href="#__codelineno-5-88"><span class="linenos" data-linenos=" 88 "></span></a>
<a id="__codelineno-5-89" name="__codelineno-5-89"></a><a href="#__codelineno-5-89"><span class="linenos" data-linenos=" 89 "></span></a># 将net.core.netdev_max_backlog的值增加到大于默认值1000
<a id="__codelineno-5-90" name="__codelineno-5-90"></a><a href="#__codelineno-5-90"><span class="linenos" data-linenos=" 90 "></span></a># 可以帮助突发网络流量，特别是在使用数千兆位网络连接速度时，
<a id="__codelineno-5-91" name="__codelineno-5-91"></a><a href="#__codelineno-5-91"><span class="linenos" data-linenos=" 91 "></span></a># 通过允许更多的数据包排队等待内核处理它们。
<a id="__codelineno-5-92" name="__codelineno-5-92"></a><a href="#__codelineno-5-92"><span class="linenos" data-linenos=" 92 "></span></a>net.core.netdev_max_backlog = 65536
<a id="__codelineno-5-93" name="__codelineno-5-93"></a><a href="#__codelineno-5-93"><span class="linenos" data-linenos=" 93 "></span></a>
<a id="__codelineno-5-94" name="__codelineno-5-94"></a><a href="#__codelineno-5-94"><span class="linenos" data-linenos=" 94 "></span></a># 增加选项内存缓冲区的最大数量
<a id="__codelineno-5-95" name="__codelineno-5-95"></a><a href="#__codelineno-5-95"><span class="linenos" data-linenos=" 95 "></span></a>net.core.optmem_max = 25165824
<a id="__codelineno-5-96" name="__codelineno-5-96"></a><a href="#__codelineno-5-96"><span class="linenos" data-linenos=" 96 "></span></a>
<a id="__codelineno-5-97" name="__codelineno-5-97"></a><a href="#__codelineno-5-97"><span class="linenos" data-linenos=" 97 "></span></a># 被动TCP连接的SYNACK次数。
<a id="__codelineno-5-98" name="__codelineno-5-98"></a><a href="#__codelineno-5-98"><span class="linenos" data-linenos=" 98 "></span></a>net.ipv4.tcp_synack_retries = 2
<a id="__codelineno-5-99" name="__codelineno-5-99"></a><a href="#__codelineno-5-99"><span class="linenos" data-linenos=" 99 "></span></a>
<a id="__codelineno-5-100" name="__codelineno-5-100"></a><a href="#__codelineno-5-100"><span class="linenos" data-linenos="100 "></span></a># 允许的本地端口范围。
<a id="__codelineno-5-101" name="__codelineno-5-101"></a><a href="#__codelineno-5-101"><span class="linenos" data-linenos="101 "></span></a>net.ipv4.ip_local_port_range = 2048 65535
<a id="__codelineno-5-102" name="__codelineno-5-102"></a><a href="#__codelineno-5-102"><span class="linenos" data-linenos="102 "></span></a>
<a id="__codelineno-5-103" name="__codelineno-5-103"></a><a href="#__codelineno-5-103"><span class="linenos" data-linenos="103 "></span></a># 防止TCP时间等待
<a id="__codelineno-5-104" name="__codelineno-5-104"></a><a href="#__codelineno-5-104"><span class="linenos" data-linenos="104 "></span></a># Default: net.ipv4.tcp_rfc1337 = 0
<a id="__codelineno-5-105" name="__codelineno-5-105"></a><a href="#__codelineno-5-105"><span class="linenos" data-linenos="105 "></span></a>net.ipv4.tcp_rfc1337 = 1
<a id="__codelineno-5-106" name="__codelineno-5-106"></a><a href="#__codelineno-5-106"><span class="linenos" data-linenos="106 "></span></a>
<a id="__codelineno-5-107" name="__codelineno-5-107"></a><a href="#__codelineno-5-107"><span class="linenos" data-linenos="107 "></span></a># 减少tcp_fin_timeout连接的时间默认值
<a id="__codelineno-5-108" name="__codelineno-5-108"></a><a href="#__codelineno-5-108"><span class="linenos" data-linenos="108 "></span></a>net.ipv4.tcp_fin_timeout = 15
<a id="__codelineno-5-109" name="__codelineno-5-109"></a><a href="#__codelineno-5-109"><span class="linenos" data-linenos="109 "></span></a>
<a id="__codelineno-5-110" name="__codelineno-5-110"></a><a href="#__codelineno-5-110"><span class="linenos" data-linenos="110 "></span></a># 积压套接字的最大数量。
<a id="__codelineno-5-111" name="__codelineno-5-111"></a><a href="#__codelineno-5-111"><span class="linenos" data-linenos="111 "></span></a># Default is 128.
<a id="__codelineno-5-112" name="__codelineno-5-112"></a><a href="#__codelineno-5-112"><span class="linenos" data-linenos="112 "></span></a>net.core.somaxconn = 32768
<a id="__codelineno-5-113" name="__codelineno-5-113"></a><a href="#__codelineno-5-113"><span class="linenos" data-linenos="113 "></span></a>
<a id="__codelineno-5-114" name="__codelineno-5-114"></a><a href="#__codelineno-5-114"><span class="linenos" data-linenos="114 "></span></a># 打开syncookies以进行SYN洪水攻击保护。
<a id="__codelineno-5-115" name="__codelineno-5-115"></a><a href="#__codelineno-5-115"><span class="linenos" data-linenos="115 "></span></a>net.ipv4.tcp_syncookies = 1
<a id="__codelineno-5-116" name="__codelineno-5-116"></a><a href="#__codelineno-5-116"><span class="linenos" data-linenos="116 "></span></a>
<a id="__codelineno-5-117" name="__codelineno-5-117"></a><a href="#__codelineno-5-117"><span class="linenos" data-linenos="117 "></span></a># 避免Smurf攻击
<a id="__codelineno-5-118" name="__codelineno-5-118"></a><a href="#__codelineno-5-118"><span class="linenos" data-linenos="118 "></span></a># 发送伪装的ICMP数据包，目的地址设为某个网络的广播地址，源地址设为要攻击的目的主机，
<a id="__codelineno-5-119" name="__codelineno-5-119"></a><a href="#__codelineno-5-119"><span class="linenos" data-linenos="119 "></span></a># 使所有收到此ICMP数据包的主机都将对目的主机发出一个回应，使被攻击主机在某一段时间内收到成千上万的数据包
<a id="__codelineno-5-120" name="__codelineno-5-120"></a><a href="#__codelineno-5-120"><span class="linenos" data-linenos="120 "></span></a>net.ipv4.icmp_echo_ignore_broadcasts = 1
<a id="__codelineno-5-121" name="__codelineno-5-121"></a><a href="#__codelineno-5-121"><span class="linenos" data-linenos="121 "></span></a>
<a id="__codelineno-5-122" name="__codelineno-5-122"></a><a href="#__codelineno-5-122"><span class="linenos" data-linenos="122 "></span></a># 为icmp错误消息打开保护
<a id="__codelineno-5-123" name="__codelineno-5-123"></a><a href="#__codelineno-5-123"><span class="linenos" data-linenos="123 "></span></a>net.ipv4.icmp_ignore_bogus_error_responses = 1
<a id="__codelineno-5-124" name="__codelineno-5-124"></a><a href="#__codelineno-5-124"><span class="linenos" data-linenos="124 "></span></a>
<a id="__codelineno-5-125" name="__codelineno-5-125"></a><a href="#__codelineno-5-125"><span class="linenos" data-linenos="125 "></span></a># 启用自动缩放窗口。
<a id="__codelineno-5-126" name="__codelineno-5-126"></a><a href="#__codelineno-5-126"><span class="linenos" data-linenos="126 "></span></a># 如果延迟证明合理，这将允许TCP缓冲区超过其通常的最大值64K。
<a id="__codelineno-5-127" name="__codelineno-5-127"></a><a href="#__codelineno-5-127"><span class="linenos" data-linenos="127 "></span></a>net.ipv4.tcp_window_scaling = 1
<a id="__codelineno-5-128" name="__codelineno-5-128"></a><a href="#__codelineno-5-128"><span class="linenos" data-linenos="128 "></span></a>
<a id="__codelineno-5-129" name="__codelineno-5-129"></a><a href="#__codelineno-5-129"><span class="linenos" data-linenos="129 "></span></a># 打开并记录欺骗，源路由和重定向数据包
<a id="__codelineno-5-130" name="__codelineno-5-130"></a><a href="#__codelineno-5-130"><span class="linenos" data-linenos="130 "></span></a>net.ipv4.conf.all.log_martians = 1
<a id="__codelineno-5-131" name="__codelineno-5-131"></a><a href="#__codelineno-5-131"><span class="linenos" data-linenos="131 "></span></a>net.ipv4.conf.default.log_martians = 1
<a id="__codelineno-5-132" name="__codelineno-5-132"></a><a href="#__codelineno-5-132"><span class="linenos" data-linenos="132 "></span></a>
<a id="__codelineno-5-133" name="__codelineno-5-133"></a><a href="#__codelineno-5-133"><span class="linenos" data-linenos="133 "></span></a># 告诉内核有多少个未附加的TCP套接字维护用户文件句柄。 万一超过这个数字，
<a id="__codelineno-5-134" name="__codelineno-5-134"></a><a href="#__codelineno-5-134"><span class="linenos" data-linenos="134 "></span></a># 孤立的连接会立即重置，并显示警告。
<a id="__codelineno-5-135" name="__codelineno-5-135"></a><a href="#__codelineno-5-135"><span class="linenos" data-linenos="135 "></span></a># Default: net.ipv4.tcp_max_orphans = 65536
<a id="__codelineno-5-136" name="__codelineno-5-136"></a><a href="#__codelineno-5-136"><span class="linenos" data-linenos="136 "></span></a>net.ipv4.tcp_max_orphans = 65536
<a id="__codelineno-5-137" name="__codelineno-5-137"></a><a href="#__codelineno-5-137"><span class="linenos" data-linenos="137 "></span></a>
<a id="__codelineno-5-138" name="__codelineno-5-138"></a><a href="#__codelineno-5-138"><span class="linenos" data-linenos="138 "></span></a># 不要在关闭连接时缓存指标
<a id="__codelineno-5-139" name="__codelineno-5-139"></a><a href="#__codelineno-5-139"><span class="linenos" data-linenos="139 "></span></a>net.ipv4.tcp_no_metrics_save = 1
<a id="__codelineno-5-140" name="__codelineno-5-140"></a><a href="#__codelineno-5-140"><span class="linenos" data-linenos="140 "></span></a>
<a id="__codelineno-5-141" name="__codelineno-5-141"></a><a href="#__codelineno-5-141"><span class="linenos" data-linenos="141 "></span></a># 启用RFC1323中定义的时间戳记：
<a id="__codelineno-5-142" name="__codelineno-5-142"></a><a href="#__codelineno-5-142"><span class="linenos" data-linenos="142 "></span></a># Default: net.ipv4.tcp_timestamps = 1
<a id="__codelineno-5-143" name="__codelineno-5-143"></a><a href="#__codelineno-5-143"><span class="linenos" data-linenos="143 "></span></a>net.ipv4.tcp_timestamps = 1
<a id="__codelineno-5-144" name="__codelineno-5-144"></a><a href="#__codelineno-5-144"><span class="linenos" data-linenos="144 "></span></a>
<a id="__codelineno-5-145" name="__codelineno-5-145"></a><a href="#__codelineno-5-145"><span class="linenos" data-linenos="145 "></span></a># 启用选择确认。
<a id="__codelineno-5-146" name="__codelineno-5-146"></a><a href="#__codelineno-5-146"><span class="linenos" data-linenos="146 "></span></a># Default: net.ipv4.tcp_sack = 1
<a id="__codelineno-5-147" name="__codelineno-5-147"></a><a href="#__codelineno-5-147"><span class="linenos" data-linenos="147 "></span></a>net.ipv4.tcp_sack = 1
<a id="__codelineno-5-148" name="__codelineno-5-148"></a><a href="#__codelineno-5-148"><span class="linenos" data-linenos="148 "></span></a>
<a id="__codelineno-5-149" name="__codelineno-5-149"></a><a href="#__codelineno-5-149"><span class="linenos" data-linenos="149 "></span></a># 增加 tcp-time-wait 存储桶池大小，以防止简单的DOS攻击。
<a id="__codelineno-5-150" name="__codelineno-5-150"></a><a href="#__codelineno-5-150"><span class="linenos" data-linenos="150 "></span></a># net.ipv4.tcp_tw_recycle 已从Linux 4.12中删除。请改用net.ipv4.tcp_tw_reuse。
<a id="__codelineno-5-151" name="__codelineno-5-151"></a><a href="#__codelineno-5-151"><span class="linenos" data-linenos="151 "></span></a>net.ipv4.tcp_max_tw_buckets = 14400
<a id="__codelineno-5-152" name="__codelineno-5-152"></a><a href="#__codelineno-5-152"><span class="linenos" data-linenos="152 "></span></a>net.ipv4.tcp_tw_reuse = 1
<a id="__codelineno-5-153" name="__codelineno-5-153"></a><a href="#__codelineno-5-153"><span class="linenos" data-linenos="153 "></span></a>
<a id="__codelineno-5-154" name="__codelineno-5-154"></a><a href="#__codelineno-5-154"><span class="linenos" data-linenos="154 "></span></a># accept_source_route 选项使网络接口接受设置了严格源路由（SSR）或松散源路由（LSR）选项的数据包。
<a id="__codelineno-5-155" name="__codelineno-5-155"></a><a href="#__codelineno-5-155"><span class="linenos" data-linenos="155 "></span></a># 以下设置将丢弃设置了SSR或LSR选项的数据包。
<a id="__codelineno-5-156" name="__codelineno-5-156"></a><a href="#__codelineno-5-156"><span class="linenos" data-linenos="156 "></span></a>net.ipv4.conf.all.accept_source_route = 0
<a id="__codelineno-5-157" name="__codelineno-5-157"></a><a href="#__codelineno-5-157"><span class="linenos" data-linenos="157 "></span></a>net.ipv4.conf.default.accept_source_route = 0
<a id="__codelineno-5-158" name="__codelineno-5-158"></a><a href="#__codelineno-5-158"><span class="linenos" data-linenos="158 "></span></a>
<a id="__codelineno-5-159" name="__codelineno-5-159"></a><a href="#__codelineno-5-159"><span class="linenos" data-linenos="159 "></span></a># 打开反向路径过滤
<a id="__codelineno-5-160" name="__codelineno-5-160"></a><a href="#__codelineno-5-160"><span class="linenos" data-linenos="160 "></span></a>net.ipv4.conf.all.rp_filter = 1
<a id="__codelineno-5-161" name="__codelineno-5-161"></a><a href="#__codelineno-5-161"><span class="linenos" data-linenos="161 "></span></a>net.ipv4.conf.default.rp_filter = 1
<a id="__codelineno-5-162" name="__codelineno-5-162"></a><a href="#__codelineno-5-162"><span class="linenos" data-linenos="162 "></span></a>
<a id="__codelineno-5-163" name="__codelineno-5-163"></a><a href="#__codelineno-5-163"><span class="linenos" data-linenos="163 "></span></a># 禁用ICMP重定向接受
<a id="__codelineno-5-164" name="__codelineno-5-164"></a><a href="#__codelineno-5-164"><span class="linenos" data-linenos="164 "></span></a>net.ipv4.conf.all.accept_redirects = 0
<a id="__codelineno-5-165" name="__codelineno-5-165"></a><a href="#__codelineno-5-165"><span class="linenos" data-linenos="165 "></span></a>net.ipv4.conf.default.accept_redirects = 0
<a id="__codelineno-5-166" name="__codelineno-5-166"></a><a href="#__codelineno-5-166"><span class="linenos" data-linenos="166 "></span></a>net.ipv4.conf.all.secure_redirects = 0
<a id="__codelineno-5-167" name="__codelineno-5-167"></a><a href="#__codelineno-5-167"><span class="linenos" data-linenos="167 "></span></a>net.ipv4.conf.default.secure_redirects = 0
<a id="__codelineno-5-168" name="__codelineno-5-168"></a><a href="#__codelineno-5-168"><span class="linenos" data-linenos="168 "></span></a>
<a id="__codelineno-5-169" name="__codelineno-5-169"></a><a href="#__codelineno-5-169"><span class="linenos" data-linenos="169 "></span></a># 禁止发送所有IPv4 ICMP重定向数据包。
<a id="__codelineno-5-170" name="__codelineno-5-170"></a><a href="#__codelineno-5-170"><span class="linenos" data-linenos="170 "></span></a>net.ipv4.conf.all.send_redirects = 0
<a id="__codelineno-5-171" name="__codelineno-5-171"></a><a href="#__codelineno-5-171"><span class="linenos" data-linenos="171 "></span></a>net.ipv4.conf.default.send_redirects = 0
<a id="__codelineno-5-172" name="__codelineno-5-172"></a><a href="#__codelineno-5-172"><span class="linenos" data-linenos="172 "></span></a>
<a id="__codelineno-5-173" name="__codelineno-5-173"></a><a href="#__codelineno-5-173"><span class="linenos" data-linenos="173 "></span></a># 开启IP转发.
<a id="__codelineno-5-174" name="__codelineno-5-174"></a><a href="#__codelineno-5-174"><span class="linenos" data-linenos="174 "></span></a>net.ipv4.ip_forward = 1
<a id="__codelineno-5-175" name="__codelineno-5-175"></a><a href="#__codelineno-5-175"><span class="linenos" data-linenos="175 "></span></a>
<a id="__codelineno-5-176" name="__codelineno-5-176"></a><a href="#__codelineno-5-176"><span class="linenos" data-linenos="176 "></span></a># 禁止IPv6
<a id="__codelineno-5-177" name="__codelineno-5-177"></a><a href="#__codelineno-5-177"><span class="linenos" data-linenos="177 "></span></a>net.ipv6.conf.lo.disable_ipv6=1
<a id="__codelineno-5-178" name="__codelineno-5-178"></a><a href="#__codelineno-5-178"><span class="linenos" data-linenos="178 "></span></a>net.ipv6.conf.all.disable_ipv6 = 1
<a id="__codelineno-5-179" name="__codelineno-5-179"></a><a href="#__codelineno-5-179"><span class="linenos" data-linenos="179 "></span></a>net.ipv6.conf.default.disable_ipv6 = 1
<a id="__codelineno-5-180" name="__codelineno-5-180"></a><a href="#__codelineno-5-180"><span class="linenos" data-linenos="180 "></span></a>
<a id="__codelineno-5-181" name="__codelineno-5-181"></a><a href="#__codelineno-5-181"><span class="linenos" data-linenos="181 "></span></a># 要求iptables不对bridge的数据进行处理
<a id="__codelineno-5-182" name="__codelineno-5-182"></a><a href="#__codelineno-5-182"><span class="linenos" data-linenos="182 "></span></a>net.bridge.bridge-nf-call-ip6tables = 1
<a id="__codelineno-5-183" name="__codelineno-5-183"></a><a href="#__codelineno-5-183"><span class="linenos" data-linenos="183 "></span></a>net.bridge.bridge-nf-call-iptables = 1
<a id="__codelineno-5-184" name="__codelineno-5-184"></a><a href="#__codelineno-5-184"><span class="linenos" data-linenos="184 "></span></a>net.bridge.bridge-nf-call-arptables = 1
<a id="__codelineno-5-185" name="__codelineno-5-185"></a><a href="#__codelineno-5-185"><span class="linenos" data-linenos="185 "></span></a>
<a id="__codelineno-5-186" name="__codelineno-5-186"></a><a href="#__codelineno-5-186"><span class="linenos" data-linenos="186 "></span></a># arp缓存
<a id="__codelineno-5-187" name="__codelineno-5-187"></a><a href="#__codelineno-5-187"><span class="linenos" data-linenos="187 "></span></a># 存在于 ARP 高速缓存中的最少层数，如果少于这个数，垃圾收集器将不会运行。缺省值是 128
<a id="__codelineno-5-188" name="__codelineno-5-188"></a><a href="#__codelineno-5-188"><span class="linenos" data-linenos="188 "></span></a>net.ipv4.neigh.default.gc_thresh1=2048
<a id="__codelineno-5-189" name="__codelineno-5-189"></a><a href="#__codelineno-5-189"><span class="linenos" data-linenos="189 "></span></a># 保存在 ARP 高速缓存中的最多的记录软限制。垃圾收集器在开始收集前，允许记录数超过这个数字 5 秒。缺省值是 512
<a id="__codelineno-5-190" name="__codelineno-5-190"></a><a href="#__codelineno-5-190"><span class="linenos" data-linenos="190 "></span></a>net.ipv4.neigh.default.gc_thresh2=4096
<a id="__codelineno-5-191" name="__codelineno-5-191"></a><a href="#__codelineno-5-191"><span class="linenos" data-linenos="191 "></span></a># 保存在 ARP 高速缓存中的最多记录的硬限制，一旦高速缓存中的数目高于此，垃圾收集器将马上运行。缺省值是 1024
<a id="__codelineno-5-192" name="__codelineno-5-192"></a><a href="#__codelineno-5-192"><span class="linenos" data-linenos="192 "></span></a>net.ipv4.neigh.default.gc_thresh3=8192
<a id="__codelineno-5-193" name="__codelineno-5-193"></a><a href="#__codelineno-5-193"><span class="linenos" data-linenos="193 "></span></a>
<a id="__codelineno-5-194" name="__codelineno-5-194"></a><a href="#__codelineno-5-194"><span class="linenos" data-linenos="194 "></span></a># 持久连接
<a id="__codelineno-5-195" name="__codelineno-5-195"></a><a href="#__codelineno-5-195"><span class="linenos" data-linenos="195 "></span></a>net.ipv4.tcp_keepalive_time = 600
<a id="__codelineno-5-196" name="__codelineno-5-196"></a><a href="#__codelineno-5-196"><span class="linenos" data-linenos="196 "></span></a>net.ipv4.tcp_keepalive_intvl = 30
<a id="__codelineno-5-197" name="__codelineno-5-197"></a><a href="#__codelineno-5-197"><span class="linenos" data-linenos="197 "></span></a>net.ipv4.tcp_keepalive_probes = 10
<a id="__codelineno-5-198" name="__codelineno-5-198"></a><a href="#__codelineno-5-198"><span class="linenos" data-linenos="198 "></span></a>
<a id="__codelineno-5-199" name="__codelineno-5-199"></a><a href="#__codelineno-5-199"><span class="linenos" data-linenos="199 "></span></a># conntrack表
<a id="__codelineno-5-200" name="__codelineno-5-200"></a><a href="#__codelineno-5-200"><span class="linenos" data-linenos="200 "></span></a>net.nf_conntrack_max=1048576
<a id="__codelineno-5-201" name="__codelineno-5-201"></a><a href="#__codelineno-5-201"><span class="linenos" data-linenos="201 "></span></a>net.netfilter.nf_conntrack_max=1048576
<a id="__codelineno-5-202" name="__codelineno-5-202"></a><a href="#__codelineno-5-202"><span class="linenos" data-linenos="202 "></span></a>net.netfilter.nf_conntrack_buckets=262144
<a id="__codelineno-5-203" name="__codelineno-5-203"></a><a href="#__codelineno-5-203"><span class="linenos" data-linenos="203 "></span></a>net.netfilter.nf_conntrack_tcp_timeout_fin_wait=30
<a id="__codelineno-5-204" name="__codelineno-5-204"></a><a href="#__codelineno-5-204"><span class="linenos" data-linenos="204 "></span></a>net.netfilter.nf_conntrack_tcp_timeout_time_wait=30
<a id="__codelineno-5-205" name="__codelineno-5-205"></a><a href="#__codelineno-5-205"><span class="linenos" data-linenos="205 "></span></a>net.netfilter.nf_conntrack_tcp_timeout_close_wait=15
<a id="__codelineno-5-206" name="__codelineno-5-206"></a><a href="#__codelineno-5-206"><span class="linenos" data-linenos="206 "></span></a>net.netfilter.nf_conntrack_tcp_timeout_established=300
<a id="__codelineno-5-207" name="__codelineno-5-207"></a><a href="#__codelineno-5-207"><span class="linenos" data-linenos="207 "></span></a>
<a id="__codelineno-5-208" name="__codelineno-5-208"></a><a href="#__codelineno-5-208"><span class="linenos" data-linenos="208 "></span></a>#############################################################################################
<a id="__codelineno-5-209" name="__codelineno-5-209"></a><a href="#__codelineno-5-209"><span class="linenos" data-linenos="209 "></span></a># 调整内核参数
<a id="__codelineno-5-210" name="__codelineno-5-210"></a><a href="#__codelineno-5-210"><span class="linenos" data-linenos="210 "></span></a>#############################################################################################
<a id="__codelineno-5-211" name="__codelineno-5-211"></a><a href="#__codelineno-5-211"><span class="linenos" data-linenos="211 "></span></a>
<a id="__codelineno-5-212" name="__codelineno-5-212"></a><a href="#__codelineno-5-212"><span class="linenos" data-linenos="212 "></span></a># 地址空间布局随机化（ASLR）是一种用于操作系统的内存保护过程，可防止缓冲区溢出攻击。
<a id="__codelineno-5-213" name="__codelineno-5-213"></a><a href="#__codelineno-5-213"><span class="linenos" data-linenos="213 "></span></a># 这有助于确保与系统上正在运行的进程相关联的内存地址不可预测，
<a id="__codelineno-5-214" name="__codelineno-5-214"></a><a href="#__codelineno-5-214"><span class="linenos" data-linenos="214 "></span></a># 因此，与这些流程相关的缺陷或漏洞将更加难以利用。
<a id="__codelineno-5-215" name="__codelineno-5-215"></a><a href="#__codelineno-5-215"><span class="linenos" data-linenos="215 "></span></a># Accepted values: 0 = 关闭, 1 = 保守随机化, 2 = 完全随机化
<a id="__codelineno-5-216" name="__codelineno-5-216"></a><a href="#__codelineno-5-216"><span class="linenos" data-linenos="216 "></span></a>kernel.randomize_va_space = 2
<a id="__codelineno-5-217" name="__codelineno-5-217"></a><a href="#__codelineno-5-217"><span class="linenos" data-linenos="217 "></span></a>
<a id="__codelineno-5-218" name="__codelineno-5-218"></a><a href="#__codelineno-5-218"><span class="linenos" data-linenos="218 "></span></a># 调高 PID 数量
<a id="__codelineno-5-219" name="__codelineno-5-219"></a><a href="#__codelineno-5-219"><span class="linenos" data-linenos="219 "></span></a>kernel.pid_max = 65536
<a id="__codelineno-5-220" name="__codelineno-5-220"></a><a href="#__codelineno-5-220"><span class="linenos" data-linenos="220 "></span></a>kernel.threads-max=30938
<a id="__codelineno-5-221" name="__codelineno-5-221"></a><a href="#__codelineno-5-221"><span class="linenos" data-linenos="221 "></span></a>
<a id="__codelineno-5-222" name="__codelineno-5-222"></a><a href="#__codelineno-5-222"><span class="linenos" data-linenos="222 "></span></a># coredump
<a id="__codelineno-5-223" name="__codelineno-5-223"></a><a href="#__codelineno-5-223"><span class="linenos" data-linenos="223 "></span></a>kernel.core_pattern=core
<a id="__codelineno-5-224" name="__codelineno-5-224"></a><a href="#__codelineno-5-224"><span class="linenos" data-linenos="224 "></span></a>
<a id="__codelineno-5-225" name="__codelineno-5-225"></a><a href="#__codelineno-5-225"><span class="linenos" data-linenos="225 "></span></a># 决定了检测到soft lockup时是否自动panic，缺省值是0
<a id="__codelineno-5-226" name="__codelineno-5-226"></a><a href="#__codelineno-5-226"><span class="linenos" data-linenos="226 "></span></a>kernel.softlockup_all_cpu_backtrace=1
<a id="__codelineno-5-227" name="__codelineno-5-227"></a><a href="#__codelineno-5-227"><span class="linenos" data-linenos="227 "></span></a>kernel.softlockup_panic=1
</code></pre></div>
<ul>
<li><a href="https://help.aliyun.com/document_detail/25455.html">参考1: 云栖原创参考</a></li>
<li><a href="https://developer.emqx.io/docs/emq/v3/cn/tune.html#tuning-guide">参考2: EMQX 官方单点百万连接调优参考</a></li>
</ul>

              
            </article>
          </div>
        </div>
        
      </main>
      
        <footer class="md-footer">
  
  <div class="md-footer-meta md-typeset">
    <div class="md-footer-meta__inner md-grid">
      <div class="md-copyright">
  
  
    Made with
    <a href="https://squidfunk.github.io/mkdocs-material/" target="_blank" rel="noopener">
      Material for MkDocs
    </a>
  
</div>
      
    </div>
  </div>
</footer>
      
    </div>
    <div class="md-dialog" data-md-component="dialog">
      <div class="md-dialog__inner md-typeset"></div>
    </div>
    <script id="__config" type="application/json">{"base": "../../../..", "features": ["search.suggest", "search.highlight", "navigation.tabs", "navigation.expand", "toc.follow", "toc.integrate"], "search": "../../../../assets/javascripts/workers/search.5e67fbfe.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.config.lang": "en", "search.config.pipeline": "trimmer, stopWordFilter", "search.config.separator": "[\\s\\-]+", "search.placeholder": "Search", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version.title": "Select version"}, "version": {"default": "latest", "provider": "mike"}}</script>
    
    
      <script src="../../../../assets/javascripts/bundle.c44cc438.min.js"></script>
      
        <script src="../../../../static/js/util.js"></script>
      
    
  </body>
</html>